note 94176 added to function.crypt

I didn't like how crypt "formatted" the salt string, that reduces the randomness of the salt and gives an attacker clues as to what's going on. It easy to "roll your own" crypt with the function below. The resultant hash only contains hex digits, making it easy to store, pass on the URL, etc without giving any clues about what it is or how it was generated. <?php function mycrypt($clear, $hashed = NULL) { $salt_len = 100; if (empty($hashed)) for($salt = '', $x = 0; $x++ < $salt_len; $salt .= bin2hex(chr(mt_rand(0,255)))); // make a new salt else $salt = substr($hashed, 0, $salt_len*2); // extract existing salt return $salt . hash('whirlpool', $salt . $clear); } ?> You can adjust the salt length and hash algorithm as you desire - whirlpool is a pretty good hash and much more secure than crypt()'s MD5. Using/adding uniq(), microtime(), ip address, uuid, etc to the salt only weakens security by reducing it's randmoness. If you think your OS can provide better random numbers, use that instead of mt_rand(). ---- Server IP: 208.69.120.35 Probable Submitter: 69.69.21.91 ---- Manual Page -- http://www.php.net/manual/en/function.crypt.php Edit -- https://master.php.net/note/edit/94176 Del: integrated -- https://master.php.net/note/delete/94176/integrated Del: useless -- https://master.php.net/note/delete/94176/useless Del: bad code -- https://master.php.net/note/delete/94176/bad+code Del: spam -- https://master.php.net/note/delete/94176/spam Del: non-english -- https://master.php.net/note/delete/94176/non-english Del: in docs -- https://master.php.net/note/delete/94176/in+docs Del: other reasons-- https://master.php.net/note/delete/94176 Reject -- https://master.php.net/note/reject/94176 Search -- https://master.php.net/manage/user-notes.php